UBUNTU-CVE-2026-72060: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64() unconditionally calls emacgetstatbyname() with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname() already guards the PA stats lookup with if (emac->prueth->pastats); when that pointer is NULL the lookup falls through to netdeverr() and returns -EINVAL. Because ndogetstats64 is polled regularly by the networking stack this produces thousands of log entries of the form: icssg-prueth icssg1-eth end0: Invalid stats FWRXERROR A secondary consequence is that the int(-EINVAL) return value is implicitly widened to a near-ULLONGMAX unsigned value when accumulated into the u64 fields of rtnllinkstats64, silently corrupting the rxerrors, rxdropped and txdropped counters reported by ip -s link. Every other PA-aware code path in the driver is already guarded with the same if (emac->prueth->pastats) check. Apply the same guard here.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Guard PA stat lookups in icssg_ndo_get_stats64 with `if (emac->prueth->pa_stats)`, so FW PA stat names are queried only when the PA stats block is present.
Event History
Frequently Asked Questions
Which systems are affected in practice?
Systems using the TI ICSSG Ethernet driver are affected when the hardware does not provide the PA statistics block. The issue is present in the listed Ubuntu kernel package families, including linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
Does exploitation require network access or an attacker action?
The described behavior is triggered by regular networking-stack polling of the driver's statistics callback. No attacker interaction or network input is described; the impact is repeated kernel log messages and incorrect interface error and drop counters.
How can I tell whether a system is affected?
Look for repeated kernel log messages such as "Invalid stats FW_RX_ERROR" from an icssg-prueth interface. You may also see implausibly large rx_errors, rx_dropped, or tx_dropped values in "ip -s link" output because -EINVAL is accumulated into unsigned 64-bit counters.
What is the mitigation if an updated kernel cannot be applied immediately?
The provided fix is to guard PA-statistics lookups with a check that the PA statistics block is present. No operational workaround is provided; until the fix is applied, treat the affected interface counters as unreliable and expect repeated log entries.